locals {
  # SSH Public Key for Provisioning
  ssh_key = var.use_vault ? data.vault_generic_secret.vm_creds[0].data["ssh_public_key"] : var.ssh_public_key
  
  # CI Credentials
  ci_user     = var.use_vault ? data.vault_generic_secret.vm_creds[0].data["ci_user"] : var.ci_user
  ci_password = var.use_vault ? data.vault_generic_secret.vm_creds[0].data["ci_password"] : var.ci_password

  vms = {
    # VLAN 30: Docker
    "vm-docker-mailcow-300" = { id = 300, cores = 4, memory = 8192, vlan = 30, tags = "docker,mailcow", ip = "10.100.30.10", gw = "10.100.30.1" }
    "vm-docker-apps-301"    = { id = 301, cores = 2, memory = 4096, vlan = 30, tags = "docker,apps",    ip = "10.100.30.11", gw = "10.100.30.1" }
    "vm-docker-traefik-302" = { id = 302, cores = 1, memory = 2048, vlan = 30, tags = "docker,ingress", ip = "10.100.30.12", gw = "10.100.30.1" }

    # VLAN 40: K3s
    "vm-k3s-master-400"     = { id = 400, cores = 2, memory = 4096, vlan = 40, tags = "k3s,master",     ip = "10.100.40.10", gw = "10.100.40.1" }
    "vm-k3s-worker-401"     = { id = 401, cores = 2, memory = 4096, vlan = 40, tags = "k3s,worker",     ip = "10.100.40.11", gw = "10.100.40.1" }
    "vm-k3s-worker-402"     = { id = 402, cores = 2, memory = 4096, vlan = 40, tags = "k3s,worker",     ip = "10.100.40.12", gw = "10.100.40.1" }
    "vm-k3s-worker-403"     = { id = 403, cores = 2, memory = 4096, vlan = 40, tags = "k3s,worker",     ip = "10.100.40.13", gw = "10.100.40.1" }

    # VLAN 90: Bastion
    "vm-bastion-900"        = { id = 900, cores = 1, memory = 2048, vlan = 90, tags = "bastion",        ip = "10.100.90.10", gw = "10.100.90.1" }
    "vm-bastion-901"        = { id = 901, cores = 1, memory = 2048, vlan = 90, tags = "bastion",        ip = "10.100.90.11", gw = "10.100.90.1" }
  }
}